New parser for Uber app in iOS using iLEAPP
🗜 Data contained in LevelDB data structures
⏳ Timestamps
📍 GPS coordinates + horizontal accuracy
🚘 Speed
🗺 Active trip information
🔗 Get it here: https://github.com/abrignoni/iLEAPP
Thanks to CCL Solutions & Alex Caithness for the LevelDB libraries used in this artifact.
Libraries are located here: https://github.com/cclgroupltd/ccl_chrome_indexeddb
#DFIR #FLOSS #FOSS #MobileForensics #DigitalForensics
Last week the awesome Heather Charpentier (my co-host on the Digital Forensics Now Podcast) and myself were working on building a parser for Google Chats in iOS. As we were looking for the location where images were share via the chat we came across a SQLite database called cacheV0.db in the /private/var/mobile/Data/Application/GUID/Library/Caches/com.google.Dynamite/ImageFetcherCache/ directory.
 |
| The cacheV0.db file in context. |
Even though we found the images tied to the chats somewhere else in the application directory, this database had a smaller resolution copy of all the files that were sent via the chats to include user avatars that were not shared via user attributable action. The database also contained images that were from deleted chats that did not remain in the folder where the chat images are kept.
It seems this database is similar in function to the Glide Image Manager Cache functionality found in some Android apps where this functionality generates and keeps a thumbnail of every image that has been rendered by the app's interface. In this context rendering means showing the image to the user within the interface of the application. You can watch a video detailing the Glide Image Manager Cache functionality and forensic significance here: https://youtu.be/Rlp-h9V6FI0
The cacheV0.db is comprised of only one table called cache that contains only two fields called id and data. The id field is of integer type and it is sequentially incremented starting at number one. The data field is of blob type and contains the thumbnail like images mentioned previously.
 |
| The cache table. |
Some details about how the database is implemented per our observations:
In summary it seems this database:
If anyone comes across additional implementations of this database do share your findings.
In order to automate the parsing of these databases in iOS I have created the Image CacheV0 parser in iLEAPP.
 |
| iLEAPP parser for cacheV0.db |
For questions or comments find me on all social media here: https://linqapp.com/abrignoni
Have you heard about binary JSON in SQLite? I hadn't. Today I was made aware of it by digital forensics examiner and software developer extraordinaire Alex Caithness.
Why would this data need to be in binary format? Per the jsonb specification there will be a reduction in data size as well as faster processing speed.
After downloading SQLite 3.45 on a Windows VM, I generated some synthetic plain text JSON data.
After importing the data I encoded the blob by using the following query:
UPDATE data set jsonblobdata = jsonb(jsonblobdata);
After the UPDATE query I ran a SELECT query to see how the data would look.
 |
| JSON binary blob |
Here is the blob field view with hex.
 |
| JSON binary blob with hex |
One of the issues with binary data structures is that text searching an extraction will be less and less productive. SQLite binary JSON does not seem to compress data that much but I can foresee a future where it will just like LevelDB or other formats. Being aware of compressed binary data, and the need to access it in clear text format, will be a key function for digital examiners today and into the future.
In order to present the blob data in clear text I used the following query:
SELECT keyf, json(jsonblobdata) from data;
The json() function does all the work for you.
 |
| Clear-text JSON |
After that one can deal with the JSON data as one usually does.
For questions or comments find me on all social media here: https://linqapp.com/abrignoni
Voting for the SANS 4Cast awards started. Voting closes on July 24, 2022. Honored for the following:
- DFIR Non-Commercial tool of the Year for xLEAPP - DFRI Social Media Contributor of the Year - Digital Forensic Investigator of the Year
If the tools have helped you do consider voting.
Thank you!
🗳 Vote for xLEAPP here: https://tinyurl.com/vote4xleapp
Tor Browser investigations usually don't go beyond possible user saved bookmarks. Thanks to a find by Loicforensic@protonmail.com (no online presence) we can locate Tor Browser thumbnails of opened tabs in the following Android directories:
Short version:
Take logical extractions from cars, trucks, and infotainment systems and parse them for interesting artifacts.
vLEAPP is Python 3 code and can be downloaded here:
https://github.com/abrignoni/VLEAPP
Long Version:
The need to analyze cars for digital forensic artifacts has grown recently as vehicles have smart mobile features by default. From GPS coordinates, contact databases, call logs, and even automated driving, the forensic value of these items cannot be overstated. Sadly there are not many options regarding tools to parse these data sources. vLEAPP aspires to be an open source platform the community can use to aggregate forensic artifacts found on the most mobile of data sources, cars.
This project started from Geraldine Blay's idea of being able to easily parse any car data source in a way that easily enables the backtracking of report data to source data. We decided to use the xLEAPP code base to do so.
Challenges
Dealing with cars brings a host of challenges to the examiner. Some are:
Short version:
Process data extractions from Chromebooks using the ChromeOS Logs Events And Protobuf Parser (CLEAPP.)
CLEAPP is made in Python 3 and can be downloaded here:
https://github.com/markmckinnon/cLeapp
Long version:
Until not too long ago extracting data for forensic analysis from Chromebooks seemed impossible. Thanks Daniel Dickerman's workflow we can extract data provided you have a username and password for the device.
Check out the peer-reviewed process here:
https://dfir.pubpub.org/pub/inkjsqrh/release/1
Thanks to Magnet Forensics the process has been automated and now its implementation is available as a free software tool called the Magnet Chromebook Acquisition Assistant.
 |
| You can do it!! |
To get the free tool go here:
https://www.magnetforensics.com/resources/magnet-chromebook-acquisition-assistant/
Now what?
So now you have an awesome extraction from the device. You will receive a file named extracted.tgz.
 |
| extracted.tgz |
What do you do with it? How can you dig into the contents? Use CLEAPP for it. You can get CLEAPP here: https://github.com/markmckinnon/cLeapp
Two step process:
 |
| Thank you gentlepeople <3 |
If you are familiar with how iLEAPP of ALEAPP works then you already know how to use CLEAPP. These projects are done in python. If you are not familiar with how to run python scripts just follow the steps in the following video.
Using CLEAPP
 |
| Click around and done |
 |
| HTML report |
 |
| Device Details |
What happens to the URL links inside Discord chats if you copy-paste them into an internet connected browser? You might be surprised to know that...
In the past I have written about the structure of Discord chats in the following platforms:
Windows:
https://abrignoni.blogspot.com/2018/03/finding-discord-app-chats-in-windows.html
macOS:
https://abrignoni.blogspot.com/2018/03/finding-discord-chats-in-os-x.html
iOS:
https://abrignoni.blogspot.com/2018/08/finding-discord-chats-in-ios.html
Linux:
Android:https://abrignoni.blogspot.com/2018/08/finding-discord-chats-in-linux-dfir.html
https://abrignoni.blogspot.com/2017/07/discord-app-forensic-artifacts-in.html
Viewing extracted data using an Android emulator:
https://abrignoni.blogspot.com/2017/08/viewing-extracted-android-app-data.html
Timely updates to the research have been provided by generous folks, like @TheKateCain, here:
https://abrignoni.blogspot.com/2020/08/update-on-discord-forensic-artifacts.html
For the last couple of days I've been working creating a parser of Discord JSON chat files using iLEAPP. If you are not familiar with iLEAPP it is a Python 3 framework designed to parse useful forensic artifacts from iOS devices. More on iLEAPP here. I wanted to validate some findings on a case I am working with the amazing @i_am_the_gia and as part of the process I used the newly created parser on @Josh_Hickman1 excellent iOS testing images. You can get his testing images here.
Here is iLEAPP's HTML report for the chat:
In that same moment I watched the most amazing trailer for The Mandalorian Season #2 thanks to @KevinPagano3. As you all should know by now, the Child just steals every scene with just how cute it is.
Going back to my report I copy one of the URLs in the attachment column and pasted it into an internet connected browser to see if it would come up. In past (2017) I did some testing on Discord for Android and found out that the links in chats could be copy-paste into a browser and be accessible from anywhere by anyone.
